4 eventlog interface definition
7 import
"lsa.idl", "security.idl";
9 [ uuid("82273fdc-e32a-18c3-3f78-827929dc23ea"),
11 helpstring("Event Logger")
14 typedef [bitmap32bit
] bitmap
{
15 EVENTLOG_SEQUENTIAL_READ
= 0x0001,
16 EVENTLOG_SEEK_READ
= 0x0002,
17 EVENTLOG_FORWARDS_READ
= 0x0004,
18 EVENTLOG_BACKWARDS_READ
= 0x0008
21 typedef [public] enum {
22 EVENTLOG_SUCCESS
= 0x0000,
23 EVENTLOG_ERROR_TYPE
= 0x0001,
24 EVENTLOG_WARNING_TYPE
= 0x0002,
25 EVENTLOG_INFORMATION_TYPE
= 0x0004,
26 EVENTLOG_AUDIT_SUCCESS
= 0x0008,
27 EVENTLOG_AUDIT_FAILURE
= 0x0010
33 } eventlog_OpenUnknown0
;
35 typedef [flag
(NDR_NOALIGN
),public] struct {
37 [charset
(DOS
),value
("eLfL")] uint8 reserved
[4];
39 time_t time_generated
;
42 eventlogEventTypes event_type
;
43 [range(0,256)] uint16 num_of_strings
;
44 uint16 event_category
;
45 uint16 reserved_flags
;
46 uint32 closing_record_number
;
48 [value
(ndr_size_dom_sid0
(&sid
, ndr
->flags
))] uint32 sid_size
;
53 nstring computer_name
;
54 [subcontext
(0),subcontext_size
(sid_size
)] dom_sid0 sid
;
55 nstring strings
[num_of_strings
];
57 [flag
(NDR_ALIGN4
)] DATA_BLOB _padding
;
58 [value
(size
)] uint32 size2
;
61 /* compat structure for samba3 on-disc eventlog format,
62 this is *NOT* used on the wire. - gd */
64 typedef [flag
(NDR_NOALIGN|NDR_PAHEX
),public] struct {
66 [charset
(DOS
),value
("eLfL")] uint8 reserved
[4];
68 time_t time_generated
;
71 eventlogEventTypes event_type
;
72 [range(0,256)] uint16 num_of_strings
;
73 uint16 event_category
;
74 uint16 reserved_flags
;
75 uint32 closing_record_number
;
77 [value
(sid.length
)] uint32 sid_length
;
79 [value
(data.length
)] uint32 data_length
;
81 [value
(2*strlen_m_term
(source_name
))] uint32 source_name_len
;
83 [value
(2*strlen_m_term
(computer_name
))] uint32 computer_name_len
;
84 nstring computer_name
;
87 [value
(2*ndr_size_string_array
(strings
, num_of_strings
, STR_NULLTERM
))] uint32 strings_len
;
88 nstring strings
[num_of_strings
];
91 } eventlog_Record_tdb
;
93 typedef [v1_enum] enum {
94 ELF_LOGFILE_HEADER_DIRTY
= 0x0001,
95 ELF_LOGFILE_HEADER_WRAP
= 0x0002,
96 ELF_LOGFILE_LOGFULL_WRITTEN
= 0x0004,
97 ELF_LOGFILE_ARCHIVE_SET
= 0x0008
98 } EVENTLOG_HEADER_FLAGS
;
100 typedef [public] struct {
101 [value
(0x30)] uint32 HeaderSize
;
102 [charset
(DOS
),value
("LfLe")] uint8 Signature
[4];
103 [value
(1)] uint32 MajorVersion
;
104 [value
(1)] uint32 MinorVersion
;
107 uint32 CurrentRecordNumber
;
108 uint32 OldestRecordNumber
;
110 EVENTLOG_HEADER_FLAGS Flags
;
112 [value
(0x30)] uint32 EndHeaderSize
;
115 typedef [public,gensize
] struct {
117 [charset
(DOS
),value
("LfLe")] uint8 Reserved
[4];
119 time_t TimeGenerated
;
122 eventlogEventTypes EventType
;
124 uint16 EventCategory
;
125 uint16 ReservedFlags
;
126 uint32 ClosingRecordNumber
;
127 [value
(56+2*(strlen_m_term
(SourceName
)+strlen_m_term
(Computername
))+UserSidLength
)] uint32 StringOffset
;
128 [value
(ndr_size_dom_sid0
(&UserSid
, ndr
->flags
))] uint32 UserSidLength
;
129 [value
(56+2*(strlen_m_term
(SourceName
)+strlen_m_term
(Computername
)))] uint32 UserSidOffset
;
131 [value
(56+2*(strlen_m_term
(SourceName
)+strlen_m_term
(Computername
))+UserSidLength
+(2*ndr_size_string_array
(Strings
, NumStrings
, STR_NULLTERM
)))] uint32 DataOffset
;
133 nstring Computername
;
134 [flag
(NDR_ALIGN4
),subcontext
(0),subcontext_size
(UserSidLength
)] dom_sid0 UserSid
;
135 nstring Strings
[NumStrings
];
136 [flag
(NDR_PAHEX
)] uint8 Data
[DataLength
];
138 [value
(Length
)] uint32 Length2
;
141 typedef [public] struct {
142 [value
(0x28)] uint32 RecordSizeBeginning
;
143 [value
(0x11111111)] uint32 One
;
144 [value
(0x22222222)] uint32 Two
;
145 [value
(0x33333333)] uint32 Three
;
146 [value
(0x44444444)] uint32 Four
;
149 uint32 CurrentRecordNumber
;
150 uint32 OldestRecordNumber
;
151 [value
(0x28)] uint32 RecordSizeEnd
;
154 /* the following is true for a non-wrapped evt file (e.g. backups
155 * generated and viewed with eventvwr) */
157 typedef [public] struct {
159 EVENTLOGRECORD records
[hdr.CurrentRecordNumber
-hdr.OldestRecordNumber
];
165 NTSTATUS eventlog_ClearEventLogW
(
166 [in] policy_handle
*handle,
167 [in,unique] lsa_String
*backupfile
172 NTSTATUS eventlog_BackupEventLogW
(
173 [in] policy_handle
*handle,
174 [in,ref] lsa_String
*backup_filename
179 NTSTATUS eventlog_CloseEventLog
(
180 [in,out] policy_handle
*handle
185 NTSTATUS eventlog_DeregisterEventSource
(
186 [in,out] policy_handle
*handle
191 NTSTATUS eventlog_GetNumRecords
(
192 [in] policy_handle
*handle,
193 [out,ref] uint32
*number
198 NTSTATUS eventlog_GetOldestRecord
(
199 [in] policy_handle
*handle,
200 [out,ref] uint32
*oldest_entry
205 [todo
] NTSTATUS eventlog_ChangeNotify
();
209 NTSTATUS eventlog_OpenEventLogW
(
210 [in,unique] eventlog_OpenUnknown0
*unknown0
,
211 [in,ref] lsa_String
*logname
,
212 [in,ref] lsa_String
*servername
,
213 [in] uint32 major_version
,
214 [in] uint32 minor_version
,
215 [out] policy_handle
*handle
220 NTSTATUS eventlog_RegisterEventSourceW
(
221 [in,unique] eventlog_OpenUnknown0
*unknown0
,
222 [in,ref] lsa_String
*module_name
,
223 [in,ref] lsa_String
*reg_module_name
,
224 [in] uint32 major_version
,
225 [in] uint32 minor_version
,
226 [out] policy_handle
*log_handle
231 NTSTATUS eventlog_OpenBackupEventLogW
(
232 [in,unique] eventlog_OpenUnknown0
*unknown0
,
233 [in,ref] lsa_String
*backup_logname
,
234 [in] uint32 major_version
,
235 [in] uint32 minor_version
,
236 [out] policy_handle
*handle
241 NTSTATUS eventlog_ReadEventLogW
(
242 [in] policy_handle
*handle,
243 [in] eventlogReadFlags flags
,
245 [in] [range(0,0x7FFFF)] uint32 number_of_bytes
,
246 [out,ref,size_is(number_of_bytes
)] uint8
*data
,
247 [out,ref] uint32
*sent_size
,
248 [out,ref] uint32
*real_size
253 NTSTATUS eventlog_ReportEventW
(
254 [in] policy_handle
*handle,
255 [in] time_t timestamp
,
256 [in] eventlogEventTypes event_type
,
257 [in] uint16 event_category
,
258 [in] uint32 event_id
,
259 [in] [range(0,256)] uint16 num_of_strings
,
260 [in] [range(0,0x3FFFF)] uint32 data_size
,
261 [in,ref] lsa_String
*servername
,
262 [in,unique] dom_sid
*user_sid
,
263 [in,unique] [size_is(num_of_strings
)] lsa_String
**strings
,
264 [in,unique] [size_is(data_size
)] uint8
*data
,
266 [in,out,unique] uint32
*record_number
,
267 [in,out,unique] time_t
*time_written
272 [todo
] NTSTATUS eventlog_ClearEventLogA
();
276 [todo
] NTSTATUS eventlog_BackupEventLogA
();
280 [todo
] NTSTATUS eventlog_OpenEventLogA
();
284 [todo
] NTSTATUS eventlog_RegisterEventSourceA
();
288 [todo
] NTSTATUS eventlog_OpenBackupEventLogA
();
292 [todo
] NTSTATUS eventlog_ReadEventLogA
();
296 [todo
] NTSTATUS eventlog_ReportEventA
();
300 [todo
] NTSTATUS eventlog_RegisterClusterSvc
();
304 [todo
] NTSTATUS eventlog_DeregisterClusterSvc
();
308 [todo
] NTSTATUS eventlog_WriteClusterEvents
();
315 } EVENTLOG_FULL_INFORMATION
;
317 NTSTATUS eventlog_GetLogIntormation
(
318 [in] policy_handle
*handle,
320 [out,ref] [size_is(buf_size
)] uint8
*buffer
,
321 [in] [range(0,1024)] uint32 buf_size
,
322 [out,ref] uint32
*bytes_needed
327 NTSTATUS eventlog_FlushEventLog
(
328 [in] policy_handle
*handle
333 NTSTATUS eventlog_ReportEventAndSourceW
(
334 [in] policy_handle
*handle,
335 [in] time_t timestamp
,
336 [in] eventlogEventTypes event_type
,
337 [in] uint16 event_category
,
338 [in] uint32 event_id
,
339 [in,ref] lsa_String
*sourcename
,
340 [in] [range(0,256)] uint16 num_of_strings
,
341 [in] [range(0,0x3FFFF)] uint32 data_size
,
342 [in,ref] lsa_String
*servername
,
343 [in,unique] dom_sid
*user_sid
,
344 [in,unique] [size_is(num_of_strings
)] lsa_String
**strings
,
345 [in,unique] [size_is(data_size
)] uint8
*data
,
347 [in,out,unique] uint32
*record_number
,
348 [in,out,unique] time_t
*time_written